CVE Vulnerability Catalog

A NULL pointer dereference vulnerability was found in the Linux kernel's ip6_rt_get_dev_rcu() function. It occurs when a slave device is being un-slaved from a VRF, causing l3mdev_master_dev_rcu() to return NULL and leading to a system crash.

A data race vulnerability was found in the Linux kernel around the sk->sk_data_ready and sk->sk_write_space pointers. The skmsg layer (and possibly others) modifies these pointers while other CPUs may read them concurrently, leading to undefined behavior.

A vulnerability in the Linux kernel causes a system panic when an IPv4 route references an IPv6 nexthop object configured on a loopback interface. The issue stems from misclassifying such an object as a reject route, skipping initialization of the nhc_pcpu_rth_output structure, leading to a NULL pointer dereference.

W jądrze Linuxa zidentyfikowano podatność związaną z błędami w kolejce socketów Bluetooth. Gdy włączone jest znacznik czasu TX, pakiety mogą utknąć w kolejce błędów, co prowadzi do ich wycieku, jeśli nie zostaną odczytane przez użytkownika lub kontroler zostanie niespodziewanie usunięty.

W jądrze Linuxa zidentyfikowano i naprawiono podatność związaną z wyciekiem pamięci struktury cred w funkcji nfsd_nl_threads_set_doit(). Problem polegał na tym, że referencja do cred była przekazywana, ale nie była odpowiednio zwalniana, co prowadziło do wycieku pamięci.

W jądrze Linuxa zidentyfikowano podatność, która prowadzi do zakleszczenia podczas wstrzymywania i wznawiania aplikacji. Problem występuje, gdy aplikacja wydaje zapytanie IOCTL w trakcie automatycznego wstrzymywania, co prowadzi do blokady zasobów.

A vulnerability in the Linux kernel's VXLAN driver causes a NULL pointer dereference in the IPv6 neighbor table (nd_tbl) when booting with the 'ipv6.disable=1' parameter. An attacker can send a crafted IPv6 packet to a VXLAN interface, triggering route_shortcircuit() and leading to a kernel Oops and potential system crash.

The pegasus USB driver in the Linux kernel lacks validation of USB endpoints. A malicious USB device can crash the driver by not providing the expected endpoints.

In the Linux kernel, the irqchip/sifive-plic driver has a vulnerability causing interrupt freezing. The issue occurs when changing interrupt affinity while a hart is still handling the interrupt, leading the PLIC controller to ignore the completion message. This results in a complete stall of interrupts for the affected device.

In the Linux kernel, a vulnerability was found in the mtk_eth_soc driver where the eBPF program pointer in mtk_xdp_setup() is not reset to old_prog on error in mtk_open, and its ref-count is incorrectly decreased.

A logic issue in Safari and Apple systems was fixed with improved state management, preventing malicious websites from accessing script message handlers intended for other origins. The patch is included in Safari 26.4, iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4.

A vulnerability in Safari and related Apple system components allows a malicious website to process restricted web content outside the sandbox. The issue was addressed with improved memory handling.

A vulnerability in WebKit may lead to an unexpected process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling. The fix is included in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4.

A vulnerability in WebKit may lead to an unexpected process crash when processing maliciously crafted web content. The issue was fixed by improving memory handling in Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4.

In Vim prior to version 9.2.0202, a command injection vulnerability exists in the glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may execute arbitrary shell commands. This depends on the user's 'shell' setting.

CVE-2026-32642 describes an incorrect authorization vulnerability in Apache Artemis and Apache ActiveMQ Artemis, allowing an authenticated user with 'createDurableQueue' permission to create a non-durable JMS subscription on a non-existent address, despite lacking 'createAddress' permission. Consequently, a temporary address is created, which should not occur.

A Cross-Site Scripting (XSS) vulnerability in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter allows an attacker to inject malicious scripts.

A vulnerability in the BFD library of GNU Binutils fails to validate relocation type values in crafted XCOFF files, leading to out-of-bounds memory reads. This can cause tool crashes or memory content disclosure.

The esaml library (and its forks) has an XXE vulnerability. Before signature verification, esaml parses attacker-controlled SAML messages using xmerl_scan:string/2 without disabling XML entity expansion. On Erlang/OTP before version 27, Xmerl allows entities by default, enabling pre-signature XXE attacks. An attacker can read local files (e.g., Kubernetes secrets) and include their contents in the SAML document.

Versions of the jsrsasign package before 11.1.1 are vulnerable to division by zero, potentially leading to incorrect RSA public-key operations. An attacker can force these operations to return predetermined zero outputs, hiding 'invalid key' errors.